Perfectly legal. The email belongs to the company not the individual.
And there are plenty of other cases, like what if personnel (or anyone) send an email with someone else’s personal information? What about threatening or abusive emails?
By law we need to keep a record of these emails, but the company is free to delete from the user’s mailbox.